{"id":37770,"date":"2025-05-13T12:30:58","date_gmt":"2025-05-13T12:30:58","guid":{"rendered":""},"modified":"2025-08-09T18:58:35","modified_gmt":"2025-08-10T00:58:35","slug":"cve-2025-0855-unauthenticated-php-object-injection-in-pgs-core-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-0855-unauthenticated-php-object-injection-in-pgs-core-wordpress-plugin\/","title":{"rendered":"CVE-2025-0855: Unauthenticated PHP Object Injection in PGS Core WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In the world of cybersecurity, the detection of new vulnerabilities is an ongoing process. One such vulnerability that has been recently identified is CVE-2025-0855, which affects the PGS Core plugin for WordPress. It is a critical vulnerability that can lead to PHP Object Injection<\/a>, enabling attackers to inject a PHP Object without requiring any authentication. This issue concerns not only individual WordPress site owners but also businesses and organizations that use this plugin, as it can potentially lead to severe consequences such as system<\/a> compromise or sensitive data leakage.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-0855
\nSeverity: Critical (CVSS score: 9.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: This vulnerability, if successfully exploited, can lead to system compromise<\/a> and data leakage.<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

PGS Core WordPress Plugin<\/a> | Up to and including 5.8.0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of an issue in the ‘import_header’ function of the PGS Core plugin for WordPress<\/a>. This function does not adequately verify the validity of input<\/a> before deserializing it, thereby allowing the injection of PHP Objects. An attacker can exploit this vulnerability by sending a specially crafted request<\/a> to the vulnerable application, leading to PHP Object Injection. If a Property-Oriented Programming (POP) chain exists in any additional plugin or theme installed on the system, the vulnerability can be further exploited to delete arbitrary<\/a> files, retrieve sensitive data, or execute arbitrary code.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s an illustrative example of how an attacker might exploit<\/a> this vulnerability. This example is purely conceptual and should not be used in a real-world scenario.<\/p>\n

POST \/wp-content\/plugins\/pgs-core\/inc\/importers\/import_header.php HTTP\/1.1\nHost: vulnerable-wordpress-site.com\nContent-Type: application\/php\nO:8:\"stdClass\":1:{s:4:\"file\";s:27:\"\/path\/to\/arbitrary\/file.php\";}<\/code><\/pre>\n
In this example, an attacker sends a POST request to the ‘import_header.php’ file<\/a>, which is part of the PGS Core plugin. The payload includes an injected PHP<\/a> Object that references an arbitrary file. If the server has a POP chain that allows file deletion<\/a>, this request could potentially delete the referenced file.<\/p>\n
Mitigation and Recommendations<\/strong><\/p>\n
The best way to mitigate this vulnerability is by applying the vendor patch. Users of the PGS Core plugin for WordPress<\/a> should upgrade to the latest version as soon as possible. As a temporary measure, one can use Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to detect and prevent exploitation of this vulnerability<\/a>. However, these are not long-term solutions and do not address the underlying issue. Regularly updating and patching software is essential in maintaining a secure<\/a> online environment.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview In the world of cybersecurity, the detection of new vulnerabilities is an ongoing process. One such vulnerability that has been recently identified is CVE-2025-0855, which affects the PGS Core plugin for WordPress. It is a critical vulnerability that can lead to PHP Object Injection, enabling attackers to inject a PHP Object without requiring any […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-37770","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t